@marcoscale98/pi-extensible-workflows 5.19.1-fork.1 → 6.2.1-fork.1

package/dist/src/background-widget.d.ts

@@ -60,7 +60,6 @@ interface ReceiptAgent {
     name: string;
     state: string;
     model?: string;
-    role?: string;
     requestedModel?: string;
     tools?: readonly string[];
     /** Accepted for rendering older receipt entries; new receipts persist granted tools. */

package/dist/src/background-widget.js

@@ -191,7 +191,7 @@ function renderableAgent(value) {
         return false;
     if (value.model.thinking !== undefined && typeof value.model.thinking !== "string")
         return false;
-    for (const key of ["id", "label", "parentId", "role", "requestedModel"])
+    for (const key of ["id", "label", "parentId", "requestedModel"])
         if (value[key] !== undefined && typeof value[key] !== "string")
             return false;
     for (const key of ["attempts", "startedAt", "durationMs", "lastEventAt"])
@@ -554,8 +554,7 @@ function renderFrame(runs, now, width, offset = 0, theme, scrolling = false, siz
                         ? mark(agent.state, now, paint, run.state)
                         : paint(silent >= STALL_MS ? ROLE.failed : ROLE.warn, "⚠")} ${
                     // The label is what the workflow called this agent — `reviewer #2`,
-                    // `scout (api)` — where the name is the role it was built from. Two
-                    // agents of one role are otherwise indistinguishable.
+                    // `scout (api)` — preserving an explicit label when supplied.
                     agent.label ?? agent.name}${silent === undefined
                         ? ""
                         : `  ${paint(silent >= STALL_MS ? ROLE.failed : ROLE.warn, `${silent >= STALL_MS ? "stalled" : "quiet"} ${formatElapsed(silent)}`)}`}`,
@@ -696,18 +695,15 @@ function receiptFor(run, fallback) {
         agents: agents.map((agent) => ({
             id: agent.id,
             ...(agent.parentId === undefined ? {} : { parentId: agent.parentId }),
-            // What the workflow called it, falling back to the role it was built
-            // from. Two agents of one role are otherwise indistinguishable.
+            // Preserve explicit display labels.
             name: agent.label ?? agent.name,
             state: agent.state,
-            // Model and thinking level together: a role picks both, and the model
-            // name alone does not say whether it reasoned cheaply or deeply.
+            // Show both model and thinking level.
             ...(agent.model.model
                 ? {
                     model: `${agent.model.model}${agent.model.thinking ? `:${agent.model.thinking}` : ""}`,
                 }
                 : {}),
-            ...(agent.role ? { role: agent.role } : {}),
             ...(agent.requestedModel ? { requestedModel: agent.requestedModel } : {}),
             tools: [...agent.tools],
             // Cache reads dwarf real input and cost almost nothing, so the split is
@@ -782,7 +778,6 @@ export function renderReceipt(data, expanded, theme) {
             lines.push(`${prefix}${lastAgent ? "╰─" : "├─"} ${glyph(agent.state)} ${agent.name} ${theme.fg("muted", detail)}`);
             const under = `${prefix}${lastAgent ? "  " : "│ "}   `;
             const meta = [
-                agent.role ? `role ${agent.role}` : "",
                 agent.requestedModel && agent.requestedModel !== agent.model
                     ? `via ${agent.requestedModel}`
                     : "",

package/dist/src/decoders.d.ts

@@ -1,4 +1,4 @@
-import { type AgentDefinition, type BudgetApprovalRequest, type JsonValue, type LaunchSnapshot, type RunRecord, type WorkflowBudgetUsage, type WorkflowExtensionSettings } from "./types.js";
+import { type PreparedAgentConfiguration, type BudgetApprovalRequest, type JsonValue, type LaunchSnapshot, type RunRecord, type WorkflowBudgetUsage, type WorkflowExtensionSettings } from "./types.js";
 import type { OwnershipRecord } from "./agent-execution.js";
 export interface EffectiveSystemPrompt {
     sessionId: string;
@@ -13,7 +13,6 @@ export interface RunSummaryAgent {
     name: string;
     label?: string;
     state: string;
-    role?: string;
     attempts: number;
 }
 export interface RunSummaryArtifacts {
@@ -59,7 +58,7 @@ export type Journal = {
     awaiting?: Record<string, AwaitingCheckpoint>;
     decisions?: Record<string, PendingWorkflowDecision>;
 };
-export declare function decodeAgentDefinition(value: unknown): AgentDefinition | undefined;
+export declare function decodePreparedAgentConfiguration(value: unknown): PreparedAgentConfiguration | undefined;
 export declare function decodeWorkflowExtensions(value: unknown): WorkflowExtensionSettings | undefined;
 export declare function decodePersistedRun(value: unknown, allowLegacyAgentSessions?: boolean): PersistedRun | undefined;
 export declare function isPersistedRun(value: unknown): value is PersistedRun;

package/dist/src/decoders.js

@@ -1,4 +1,4 @@
-import { AGENT_STATES, BUDGET_DIMENSIONS, BUDGET_EVENT_TYPES, RUN_STATES, isContextFileScope } from "./types.js";
+import { AGENT_STATES, BUDGET_DIMENSIONS, BUDGET_EVENT_TYPES, RUN_STATES, isContextFileScope, LAUNCH_SNAPSHOT_IDENTITY_VERSION } from "./types.js";
 import { finiteNumber, isThinkingLevel, isWorkflowErrorCode, jsonValue, object, positiveInteger, validWorkflowExtensionNamespace } from "./utils.js";
 const INVALID_PERSISTED_VALUE = Symbol("invalid persisted value");
 function integer(value) { return finiteNumber(value) && Number.isInteger(value); }
@@ -64,28 +64,21 @@ function decodeAgentResourceSelectors(value) {
     return { ...(skills === undefined ? {} : { skills }), ...(extensions === undefined ? {} : { extensions }), ...(tools === undefined ? {} : { tools }) };
 }
 function decodeContextFileScopes(value) { return decodeArray(value, (scope) => isContextFileScope(scope) ? scope : undefined); }
-export function decodeAgentDefinition(value) {
-    if (!object(value))
+export function decodePreparedAgentConfiguration(value) {
+    if (!object(value) || !jsonValue(value) || typeof value.projectTrusted !== "boolean" || typeof value.systemPromptAppend !== "string")
         return undefined;
-    const prompt = optionalString(value.prompt);
-    const description = optionalString(value.description);
-    const model = optionalString(value.model);
-    const thinking = value.thinking;
-    const tools = value.tools === undefined ? undefined : decodeStringArray(value.tools);
-    const skills = value.skills === undefined ? undefined : decodeStringArray(value.skills);
-    const extensions = value.extensions === undefined ? undefined : decodeStringArray(value.extensions);
-    const overrideSystemPrompt = optionalBoolean(value.overrideSystemPrompt);
+    const model = decodeModelSpec(value.model);
+    const tools = decodeStringArray(value.tools);
+    const skills = decodeStringArray(value.skills);
+    const extensions = decodeStringArray(value.extensions);
+    const settings = decodeWorkflowExtensions(value.settings);
     const contextFiles = value.contextFiles === undefined ? undefined : decodeContextFileScopes(value.contextFiles);
-    const extensionSettings = value.extensionSettings === undefined ? undefined : decodeWorkflowExtensions(value.extensionSettings);
-    if (prompt === INVALID_PERSISTED_VALUE || description === INVALID_PERSISTED_VALUE || model === INVALID_PERSISTED_VALUE || overrideSystemPrompt === INVALID_PERSISTED_VALUE)
-        return undefined;
-    if (thinking !== undefined && !isThinkingLevel(thinking) || value.tools !== undefined && !tools || value.skills !== undefined && !skills || value.extensions !== undefined && !extensions || value.contextFiles !== undefined && !contextFiles || value.extensionSettings !== undefined && !extensionSettings)
+    const label = optionalString(value.label);
+    const systemPrompt = optionalString(value.systemPrompt);
+    const excludeTools = value.excludeTools === undefined ? undefined : decodeStringArray(value.excludeTools);
+    if (!model || !tools || !skills || !extensions || !settings || label === INVALID_PERSISTED_VALUE || systemPrompt === INVALID_PERSISTED_VALUE || value.contextFiles !== undefined && !contextFiles || value.excludeTools !== undefined && !excludeTools)
         return undefined;
-    const foldedModel = typeof model === "string" && thinking !== undefined && !model.includes(":") ? `${model}:${thinking}` : model;
-    return {
-        ...(prompt === undefined ? {} : { prompt }), ...(description === undefined ? {} : { description }), ...(foldedModel === undefined ? {} : { model: foldedModel }),
-        ...(tools === undefined ? {} : { tools }), ...(skills === undefined ? {} : { skills }), ...(extensions === undefined ? {} : { extensions }), ...(overrideSystemPrompt === undefined ? {} : { overrideSystemPrompt }), ...(contextFiles === undefined ? {} : { contextFiles }), ...(extensionSettings === undefined ? {} : { extensionSettings }),
-    };
+    return { model, tools, skills, extensions, settings, projectTrusted: value.projectTrusted, systemPromptAppend: value.systemPromptAppend, ...(contextFiles === undefined ? {} : { contextFiles }), ...(excludeTools === undefined ? {} : { excludeTools }), ...(label === undefined ? {} : { label }), ...(systemPrompt === undefined ? {} : { systemPrompt }) };
 }
 function decodeWorkflowMetadata(value) {
     if (!object(value) || typeof value.name !== "string")
@@ -211,17 +204,25 @@ function decodeScheduledAgentOptions(value) {
     const parentBreadcrumb = optionalString(value.parentBreadcrumb);
     const worktreeOwner = optionalString(value.worktreeOwner);
     const model = optionalString(value.model);
-    const role = typeof value.role === "string" ? value.role : undefined;
     const contextFiles = value.contextFiles === undefined ? undefined : decodeContextFileScopes(value.contextFiles);
     const schema = value.schema === undefined ? undefined : decodeJsonObject(value.schema);
     const retries = optionalNumber(value.retries);
     const timeoutMs = value.timeoutMs;
+    if (value.projectTrusted !== undefined && typeof value.projectTrusted !== "boolean")
+        return undefined;
+    const rawCapabilities = value.capabilities;
+    const capabilities = rawCapabilities === undefined ? undefined : object(rawCapabilities) ? { tools: decodeStringArray(rawCapabilities.tools), skills: decodeStringArray(rawCapabilities.skills), extensions: decodeStringArray(rawCapabilities.extensions) } : undefined;
+    if (rawCapabilities !== undefined && (!capabilities?.tools || !capabilities.skills || !capabilities.extensions))
+        return undefined;
+    const configuration = value.configuration === undefined ? undefined : decodePreparedAgentConfiguration(value.configuration);
+    if (value.configuration !== undefined && configuration === undefined)
+        return undefined;
     const agentOptions = value.agentOptions === undefined ? undefined : decodeJsonObject(value.agentOptions);
     const agentIdentity = value.agentIdentity === undefined ? undefined : decodeIdentity(value.agentIdentity);
     const sessionPath = optionalString(value.sessionPath);
     const continuity = value.continuity === undefined ? undefined : isAgentContinuity(value.continuity) ? value.continuity : INVALID_PERSISTED_VALUE;
     const extensionSettings = value.extensionSettings === undefined ? undefined : decodeWorkflowExtensions(value.extensionSettings);
-    if (sessionPath === INVALID_PERSISTED_VALUE || continuity === INVALID_PERSISTED_VALUE || requestedLabel === INVALID_PERSISTED_VALUE || parentBreadcrumb === INVALID_PERSISTED_VALUE || worktreeOwner === INVALID_PERSISTED_VALUE || model === INVALID_PERSISTED_VALUE || value.skills !== undefined && !skills || value.extensions !== undefined && !extensions || (value.role !== undefined && typeof value.role !== "string") || (value.contextFiles !== undefined && !contextFiles) || (value.schema !== undefined && !schema) || retries === INVALID_PERSISTED_VALUE || (retries !== undefined && !integer(retries)) || (timeoutMs !== undefined && timeoutMs !== null && !finiteNumber(timeoutMs)) || (value.agentOptions !== undefined && !agentOptions) || (value.agentIdentity !== undefined && !agentIdentity) || (value.extensionSettings !== undefined && !extensionSettings))
+    if (sessionPath === INVALID_PERSISTED_VALUE || continuity === INVALID_PERSISTED_VALUE || requestedLabel === INVALID_PERSISTED_VALUE || parentBreadcrumb === INVALID_PERSISTED_VALUE || worktreeOwner === INVALID_PERSISTED_VALUE || model === INVALID_PERSISTED_VALUE || value.skills !== undefined && !skills || value.extensions !== undefined && !extensions || (value.contextFiles !== undefined && !contextFiles) || (value.schema !== undefined && !schema) || retries === INVALID_PERSISTED_VALUE || (retries !== undefined && !integer(retries)) || (timeoutMs !== undefined && timeoutMs !== null && !finiteNumber(timeoutMs)) || (value.agentOptions !== undefined && !agentOptions) || (value.agentIdentity !== undefined && !agentIdentity) || (value.extensionSettings !== undefined && !extensionSettings))
         return undefined;
     return {
         label: value.label,
@@ -232,7 +233,6 @@ function decodeScheduledAgentOptions(value) {
         ...(skills === undefined ? {} : { skills }), ...(extensions === undefined ? {} : { extensions }),
         ...(worktreeOwner === undefined ? {} : { worktreeOwner }),
         ...(model === undefined ? {} : { model }),
-        ...(role === undefined ? {} : { role }),
         ...(contextFiles === undefined ? {} : { contextFiles }),
         ...(schema === undefined ? {} : { schema }),
         ...(retries === undefined ? {} : { retries }),
@@ -240,6 +240,9 @@ function decodeScheduledAgentOptions(value) {
         ...(sessionPath === undefined ? {} : { sessionPath }),
         ...(continuity === undefined ? {} : { continuity }),
         ...(agentOptions === undefined ? {} : { agentOptions }),
+        ...(configuration === undefined ? {} : { configuration }),
+        ...(value.projectTrusted === undefined ? {} : { projectTrusted: value.projectTrusted }),
+        ...(capabilities?.tools && capabilities.skills && capabilities.extensions ? { capabilities: { tools: capabilities.tools, skills: capabilities.skills, extensions: capabilities.extensions } } : {}),
         ...(agentIdentity === undefined ? {} : { agentIdentity }),
         ...(extensionSettings === undefined ? {} : { extensionSettings }),
     };
@@ -288,12 +291,11 @@ function decodeAgentResourceInspection(value) {
     const sources = sourceRecord === undefined ? undefined : {
         global: decodeAgentResourceSelectors(sourceRecord.global),
         project: decodeAgentResourceSelectors(sourceRecord.project),
-        ...(sourceRecord.role === undefined ? {} : { role: decodeAgentResourceSelectors(sourceRecord.role) }),
         ...(sourceRecord.call === undefined ? {} : { call: decodeAgentResourceSelectors(sourceRecord.call) }),
     };
-    if (!selectors || !skills || !extensions || !tools || !unmatchedSkills || !unmatchedExtensions || !unmatchedTools || rawSources !== undefined && (!sources || !sources.global || !sources.project || sources.role === undefined && sourceRecord?.role !== undefined || sources.call === undefined && sourceRecord?.call !== undefined))
+    if (!selectors || !skills || !extensions || !tools || !unmatchedSkills || !unmatchedExtensions || !unmatchedTools || rawSources !== undefined && (!sources || !sources.global || !sources.project || sources.call === undefined && sourceRecord?.call !== undefined))
         return undefined;
-    return { selectors: { skills: [...(selectors.skills ?? [])], extensions: [...(selectors.extensions ?? [])], tools: [...(selectors.tools ?? [])] }, skills, extensions, tools, unmatchedSkills, unmatchedExtensions, unmatchedTools, ...(sources === undefined ? {} : { selectorSources: { global: sources.global ?? {}, project: sources.project ?? {}, ...(sources.role === undefined ? {} : { role: sources.role }), ...(sources.call === undefined ? {} : { call: sources.call }) } }) };
+    return { selectors: { skills: [...(selectors.skills ?? [])], extensions: [...(selectors.extensions ?? [])], tools: [...(selectors.tools ?? [])] }, skills, extensions, tools, unmatchedSkills, unmatchedExtensions, unmatchedTools, ...(sources === undefined ? {} : { selectorSources: { global: sources.global ?? {}, project: sources.project ?? {}, ...(sources.call === undefined ? {} : { call: sources.call }) } }) };
 }
 function decodeAgentSetupSummary(value) {
     if (!object(value) || typeof value.cwd !== "string")
@@ -337,7 +339,6 @@ function decodeAgent(value) {
     const worktreeOwner = optionalString(value.worktreeOwner);
     const handle = optionalString(value.handle);
     const continuity = value.continuity === undefined ? undefined : isAgentContinuity(value.continuity) ? value.continuity : INVALID_PERSISTED_VALUE;
-    const role = optionalString(value.role);
     const requestedModel = optionalString(value.requestedModel);
     const startedAt = optionalNumber(value.startedAt);
     const durationMs = optionalNumber(value.durationMs);
@@ -346,7 +347,7 @@ function decodeAgent(value) {
     const toolCalls = value.toolCalls === undefined ? undefined : decodeArray(value.toolCalls, decodeAgentToolCall);
     const activity = value.activity === undefined ? undefined : decodeAgentActivity(value.activity);
     const lastEventAt = optionalNumber(value.lastEventAt);
-    if (systemPrompt === INVALID_PERSISTED_VALUE || prompt === INVALID_PERSISTED_VALUE || label === INVALID_PERSISTED_VALUE || parentId === INVALID_PERSISTED_VALUE || resultPath === INVALID_PERSISTED_VALUE || parentBreadcrumb === INVALID_PERSISTED_VALUE || worktreeOwner === INVALID_PERSISTED_VALUE || role === INVALID_PERSISTED_VALUE || requestedModel === INVALID_PERSISTED_VALUE || startedAt === INVALID_PERSISTED_VALUE || durationMs === INVALID_PERSISTED_VALUE || lastEventAt === INVALID_PERSISTED_VALUE || handle === INVALID_PERSISTED_VALUE || continuity === INVALID_PERSISTED_VALUE || handle !== undefined && !positiveInteger(value.turn))
+    if (systemPrompt === INVALID_PERSISTED_VALUE || prompt === INVALID_PERSISTED_VALUE || label === INVALID_PERSISTED_VALUE || parentId === INVALID_PERSISTED_VALUE || resultPath === INVALID_PERSISTED_VALUE || parentBreadcrumb === INVALID_PERSISTED_VALUE || worktreeOwner === INVALID_PERSISTED_VALUE || requestedModel === INVALID_PERSISTED_VALUE || startedAt === INVALID_PERSISTED_VALUE || durationMs === INVALID_PERSISTED_VALUE || lastEventAt === INVALID_PERSISTED_VALUE || handle === INVALID_PERSISTED_VALUE || continuity === INVALID_PERSISTED_VALUE || handle !== undefined && !positiveInteger(value.turn))
         return undefined;
     if (!model || !tools || value.structuralPath !== undefined && !structuralPath || value.attemptDetails !== undefined && !attemptDetails || value.accounting !== undefined && !accounting || value.toolCalls !== undefined && !toolCalls || value.activity !== undefined && !activity)
         return undefined;
@@ -365,7 +366,6 @@ function decodeAgent(value) {
         ...(worktreeOwner === undefined ? {} : { worktreeOwner }),
         ...(handle === undefined ? {} : { handle, turn: value.turn }),
         ...(continuity === undefined ? {} : { continuity }),
-        ...(role === undefined ? {} : { role }),
         ...(requestedModel === undefined ? {} : { requestedModel }),
         model,
         tools,
@@ -539,14 +539,12 @@ export function decodeLaunchSnapshot(value) {
     const phases = value.phases === undefined ? undefined : decodeStringArray(value.phases);
     const models = decodeStringArray(value.models);
     const tools = decodeStringArray(value.tools);
-    const agentTypes = decodeStringArray(value.agentTypes);
-    const roles = value.roles === undefined ? undefined : decodeRecord(value.roles, decodeAgentDefinition);
-    const projectRoles = value.projectRoles === undefined ? undefined : decodeStringArray(value.projectRoles);
+    const agentConfigurations = decodeRecord(value.agentConfigurations, decodePreparedAgentConfiguration);
     const schemas = decodeArray(value.schemas, decodeJsonObject);
-    if (identityVersion === INVALID_PERSISTED_VALUE || value.identityVersion !== undefined && !integer(identityVersion) || launchMode !== undefined && !isLaunchMode(launchMode) || args === undefined || !metadata || !settings || value.settingsSources !== undefined && !settingsSources || value.budget !== undefined && !budget || settingsPath === INVALID_PERSISTED_VALUE || value.modelAliases !== undefined && !modelAliases || value.phases !== undefined && !phases || !models || !tools || !agentTypes || value.roles !== undefined && !roles || value.projectRoles !== undefined && !projectRoles || !schemas)
+    if (identityVersion !== LAUNCH_SNAPSHOT_IDENTITY_VERSION || launchMode !== undefined && !isLaunchMode(launchMode) || args === undefined || !metadata || !settings || value.settingsSources !== undefined && !settingsSources || value.budget !== undefined && !budget || settingsPath === INVALID_PERSISTED_VALUE || value.modelAliases !== undefined && !modelAliases || value.phases !== undefined && !phases || !models || !tools || !agentConfigurations || !schemas)
         return undefined;
     return {
-        ...(identityVersion === undefined ? {} : { identityVersion }),
+        identityVersion: LAUNCH_SNAPSHOT_IDENTITY_VERSION,
         ...(launchMode === undefined ? {} : { launchMode }),
         script: value.script,
         args,
@@ -559,9 +557,7 @@ export function decodeLaunchSnapshot(value) {
         ...(phases === undefined ? {} : { phases }),
         models,
         tools,
-        agentTypes,
-        ...(roles === undefined ? {} : { roles }),
-        ...(projectRoles === undefined ? {} : { projectRoles }),
+        agentConfigurations,
         schemas,
     };
 }

package/dist/src/execution.d.ts

@@ -3,6 +3,8 @@ import type { AgentAttempt } from "./agent-execution.js";
 import type { AgentIdentity, JsonValue, ShellIdentity, ShellOptions, ShellResult, ToolIdentity, WorkflowBridge, WorkflowExecution } from "./types.js";
 export declare const RPC_LIMIT_BYTES: number;
 export declare const HEARTBEAT_TIMEOUT_MS = 5000;
+/** Script handle names may not start with this: registered-function handles are journaled under it. */
+export declare const FUNCTION_HANDLE_PREFIX = "function-handle";
 export declare function encoded(value: JsonValue): string;
 export declare function encoded(value: unknown): asserts value is JsonValue;
 /** The journal path of a script tool call; the arguments' digest keeps calls with different arguments apart whatever order they start in. */

package/dist/src/execution.js

@@ -4,7 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { structuralPath as operationPath } from "./persistence.js";
-import { WorkflowError, roleNameOf, sumAccounting, zeroAccounting } from "./types.js";
+import { WorkflowError, sumAccounting, zeroAccounting } from "./types.js";
 import { asWorkflowError, errorText, fail, isWorkflowAuthored, isWorkflowErrorCode, jsonDigest, jsonValue, markWorkflowAuthored, object, positiveInteger } from "./utils.js";
 import { instrumentWorkflow, validateAgentOptions, validateShellCommand, validateShellOptions } from "./validation.js";
 export const RPC_LIMIT_BYTES = 10 * 1024 * 1024;
@@ -35,6 +35,8 @@ function isRpcMessage(value) {
 }
 const HEARTBEAT_INTERVAL_MS = 1000;
 const OUTCOME_ERRORS = new Set(["AGENT_TIMEOUT", "AGENT_FAILED", "RESULT_INVALID"]);
+/** Script handle names may not start with this: registered-function handles are journaled under it. */
+export const FUNCTION_HANDLE_PREFIX = "function-handle";
 const WORK_RESULT_BRAND = "__workResult";
 const childSource = String.raw `
 "use strict";
@@ -145,15 +147,13 @@ const internalAgent = (...values) => {
   void result.then(() => agentInflight.delete(occurrenceKey), () => agentInflight.delete(occurrenceKey));
   return guardedAgentResult(result);
 };
-const AGENT_HANDLE_KEYS = ["name", "role", "model", "tools", "skills", "extensions", "contextFiles", "label"];
 const agentHandleNames = new Set();
 const agentHandleInflight = new Set();
 const internalAgentCreate = (...values) => {
   if (values.length !== 1 || !values[0] || typeof values[0] !== "object" || Array.isArray(values[0])) throw workError("INVALID_METADATA", "agent.create requires one options object");
   const options = values[0];
   const name = named(options.name, "agent.create");
-  const unsupported = Object.keys(options).find(key => !AGENT_HANDLE_KEYS.includes(key));
-  if (unsupported) throw workError("INVALID_METADATA", "agent.create option is unsupported: " + unsupported);
+  if (name.startsWith("${FUNCTION_HANDLE_PREFIX}/")) throw workError("INVALID_METADATA", "Agent handle names may not start with ${FUNCTION_HANDLE_PREFIX}/");
   if (agentHandleNames.has(name)) throw workError("INVALID_METADATA", "Duplicate agent handle name: " + name);
   agentHandleNames.add(name);
   const config = Object.freeze(Object.fromEntries(Object.entries(options).filter(([key]) => key !== "name")));
@@ -655,7 +655,7 @@ export function runWorkflow(script, args = null, bridge = {}, signal) {
                 const opts = validateAgentOptions(values[1]);
                 const identity = readAgentIdentity(values[2]);
                 const path = agentIdentityPath(identity);
-                const label = typeof opts.label === "string" ? opts.label : roleNameOf(opts.role) ?? "agent";
+                const label = typeof opts.label === "string" ? opts.label : "agent";
                 try {
                     const result = await bridge.agent(values[0], opts, controller.signal, identity);
                     value = branded({ name: label, ok: true, value: result ?? null });

package/dist/src/host-delivery.js

@@ -101,9 +101,9 @@ const WORKFLOW_ERROR_PROSE = {
     REGISTRY_FROZEN: (detail) => `Workflow extension registration is closed: ${detail}.`,
     GLOBAL_COLLISION: (detail) => `The workflow global name is already in use: ${detail}.`,
     MISSING_WORKFLOW: (detail) => `The registered workflow function is unavailable: ${detail}.`,
-    UNKNOWN_MODEL: (detail) => `The workflow requested the unavailable model ${detail.replace(/^(?:Unknown model(?: for role [^:]+)?|Invalid model spec):\s*/, "")}.`,
+    UNKNOWN_MODEL: (detail) => `The workflow requested the unavailable model ${detail.replace(/^(?:Unknown model|Invalid model spec|Required model is unavailable):\s*/, "")}.`,
     UNKNOWN_TOOL: (detail) => `The workflow requested the unavailable tool ${detail.replace(/^Unknown tool:\s*/, "")}.`,
-    UNKNOWN_AGENT_TYPE: (detail) => `The workflow requested the unavailable agent role ${detail.replace(/^Unknown agent role:\s*/, "")}.`,
+    UNKNOWN_AGENT: (detail) => `The workflow requested an unavailable owned agent: ${detail}.`,
     RUN_OWNED: (detail) => /already owned|active ownership/.test(detail) ? "The workflow session is already in use." : `The workflow session is already in use: ${detail}.`,
     RUN_NOT_FOUND: (detail) => /^Unknown workflow run\b/.test(detail) ? "The workflow run was not found." : `The workflow run was not found: ${detail}.`,
     RPC_LIMIT_EXCEEDED: (detail) => `The workflow communication data exceeded its size limit: ${detail}.`,
@@ -205,7 +205,6 @@ function boundedWorkflowFailureDiagnostics(value) {
         ...(value.failedAgent ? { failedAgent: {
                 id: utf8Prefix(value.failedAgent.id, 128),
                 ...(value.failedAgent.label ? { label: utf8Prefix(value.failedAgent.label, 128) } : {}),
-                ...(value.failedAgent.role ? { role: utf8Prefix(value.failedAgent.role, 128) } : {}),
                 structuralPath: value.failedAgent.structuralPath.slice(0, 8).map((part) => utf8Prefix(part, 128)),
                 attempt: value.failedAgent.attempt,
                 ...(value.failedAgent.transport ? { transport: utf8Prefix(value.failedAgent.transport, 128) } : {}),
@@ -214,7 +213,6 @@ function boundedWorkflowFailureDiagnostics(value) {
         completedSiblingAgents: (value.completedSiblingAgents ?? []).slice(0, 16).map((agent) => ({
             id: utf8Prefix(agent.id, 128),
             ...(agent.label ? { label: utf8Prefix(agent.label, 128) } : {}),
-            ...(agent.role ? { role: utf8Prefix(agent.role, 128) } : {}),
             structuralPath: agent.structuralPath.slice(0, 8).map((part) => utf8Prefix(part, 128)),
         })),
         completedSiblingPaths: value.completedSiblingPaths.slice(0, 16).map((path) => path.slice(0, 8).map((part) => utf8Prefix(part, 128))),
@@ -306,7 +304,6 @@ export async function createWorkflowFailureDiagnostics(store, metadata, error, r
     const failedAgent = failedAgentRecord ? {
         id: failedAgentRecord.id,
         ...(failedAgentRecord.label ?? failedAgentRecord.name ? { label: failedAgentRecord.label ?? failedAgentRecord.name } : {}),
-        ...(failedAgentRecord.role ? { role: failedAgentRecord.role } : {}),
         structuralPath: [...(failedAgentRecord.structuralPath ?? [])],
         attempt: Math.max(1, failedAttempt?.attempt ?? failedAgentRecord.attempts),
         ...(failedAttempt?.transport ? { transport: failedAttempt.transport } : {}),
@@ -319,7 +316,6 @@ export async function createWorkflowFailureDiagnostics(store, metadata, error, r
     }).map((agent) => ({
         id: agent.id,
         ...(agent.label ?? agent.name ? { label: agent.label ?? agent.name } : {}),
-        ...(agent.role ? { role: agent.role } : {}),
         structuralPath: [...(agent.structuralPath ?? [])],
     }));
     const completedSiblingPaths = completedSiblingAgents.map((agent) => [...agent.structuralPath]);
@@ -347,9 +343,9 @@ export async function createWorkflowFailureDiagnostics(store, metadata, error, r
     });
 }
 export function formatWorkflowFailureDiagnostics(diagnostic) {
-    const failedAgent = diagnostic.failedAgent ? `${diagnostic.failedAgent.label ?? diagnostic.failedAgent.id}${diagnostic.failedAgent.role ? ` role=${diagnostic.failedAgent.role}` : ""} attempt=${String(diagnostic.failedAgent.attempt)} path=${diagnostic.failedAgent.structuralPath.join(" > ") || "(root)"}${diagnostic.failedAgent.session ? ` session=${diagnostic.failedAgent.session.transport}/${diagnostic.failedAgent.session.sessionId}` : ""}` : "(not persisted)";
+    const failedAgent = diagnostic.failedAgent ? `${diagnostic.failedAgent.label ?? diagnostic.failedAgent.id} attempt=${String(diagnostic.failedAgent.attempt)} path=${diagnostic.failedAgent.structuralPath.join(" > ") || "(root)"}${diagnostic.failedAgent.session ? ` session=${diagnostic.failedAgent.session.transport}/${diagnostic.failedAgent.session.sessionId}` : ""}` : "(not persisted)";
     const siblingAgents = diagnostic.completedSiblingAgents;
-    const siblings = siblingAgents ? siblingAgents.map((agent) => `${agent.label ?? agent.id}${agent.role ? ` role=${agent.role}` : ""} path=${agent.structuralPath.join(" > ") || "(root)"}`).join(", ") || "(none)" : diagnostic.completedSiblingPaths.map((path) => path.join(" > ") || "(root)").join(", ") || "(none)";
+    const siblings = siblingAgents ? siblingAgents.map((agent) => `${agent.label ?? agent.id} path=${agent.structuralPath.join(" > ") || "(root)"}`).join(", ") || "(none)" : diagnostic.completedSiblingPaths.map((path) => path.join(" > ") || "(root)").join(", ") || "(none)";
     const retry = diagnostic.retry ? [`  Retry: ${diagnostic.retry.action}`, `  Replayable completed paths: ${diagnostic.retry.completedPaths.join(", ") || "(none)"}`, `  Incomplete paths: ${diagnostic.retry.incompletePaths.join(", ") || "(unknown)"}`, `  Named worktrees: ${diagnostic.retry.namedWorktrees.join(", ") || "(none)"}`, `  Warning: ${diagnostic.retry.warning}`] : [];
     return [`✗ Workflow: ${diagnostic.workflowName}`, `  Run: ${diagnostic.runId}`, `  State: ${diagnostic.state}`, `  Error: ${diagnostic.error.code}: ${diagnostic.error.message}`, `  Failed at: ${diagnostic.failedAt ?? "(unknown)"}`, `  Failed agent: ${failedAgent}`, `  Completed sibling ${siblingAgents ? "agents" : "paths"}: ${siblings}`, ...retry, `  Artifacts: state=${diagnostic.artifacts.statePath} journal=${diagnostic.artifacts.journalPath}`].join("\n");
 }

package/dist/src/host-navigator.js

@@ -827,9 +827,10 @@ export function registerWorkflowNavigator(deps) {
                                         const styles = themeWorkflowProgressStyles(theme);
                                         const agent = selectedAgentRecord();
                                         const actions = actionMode ? { title: agent ? "Agent actions" : "Run actions", options: actionOptions(), index: actionIndex } : undefined;
-                                        const phaseLines = formatWorkflowPhaseDashboard(view.run, view.snapshot, width, { nodeId: selectedNodeId, expandedNodeIds: [...expandedNodeIds], ...(narrow && !detailsMode && !actionMode ? { treeOnly: true } : {}), ...(narrow && (detailsMode || actionMode) ? { detailsOnly: true } : {}), ...(actions ? { actions } : {}) }, styles, progressNow());
+                                        const formatPhaseLines = (scrollTop) => formatWorkflowPhaseDashboard(view.run, view.snapshot, width, { scrollTop, nodeId: selectedNodeId, expandedNodeIds: [...expandedNodeIds], ...(narrow && !detailsMode && !actionMode ? { treeOnly: true } : {}), ...(narrow && (detailsMode || actionMode) ? { detailsOnly: true } : {}), ...(actions ? { actions } : {}) }, styles, progressNow());
+                                        const phaseLines = formatPhaseLines(0);
                                         const statusLines = stopStatus ? truncateToVisualLines(styles.error(stopStatus), Number.MAX_SAFE_INTEGER, width, 0).visualLines.map((line) => line.trimEnd()) : [];
-                                        const content = [...statusLines, ...phaseLines];
+                                        let content = [...statusLines, ...phaseLines];
                                         const rows = terminalRows();
                                         const hintRows = rows >= 3 ? 1 : 0;
                                         const confirmRows = inlineConfirm.rows(width, styles);
@@ -857,6 +858,8 @@ export function registerWorkflowNavigator(deps) {
                                             selectionNeedsScroll = false;
                                         }
                                         dashboardOffset = Math.max(0, Math.min(maxOffset, dashboardOffset));
+                                        if (!narrow && !actionMode)
+                                            content = [...statusLines, ...formatPhaseLines(Math.max(0, dashboardOffset - statusLines.length))];
                                         const selectedNode = selectedNodeId ? tree.byId.get(selectedNodeId) : undefined;
                                         const enterAction = selectedNode?.kind === "workflow" ? "run actions" : selectedNode?.kind === "agent" ? "agent actions" : selectedNode?.children.length ? "expand/collapse" : narrow ? "inspect" : "focus details";
                                         const hint = truncateToVisualLines(theme.fg("dim", inlineConfirm.active() ? inlineConfirm.hint(keybindings) : actionMode ? `${keyLabel("tui.select.up", "↑")}/${keyLabel("tui.select.down", "↓")} actions · ${keyLabel("tui.select.confirm", "enter")} run · ${keyLabel("tui.editor.cursorLeft", "←")} tree · ${keyLabel("tui.select.cancel", "esc")} tree` : `${keyLabel("tui.select.up", "↑")}/${keyLabel("tui.select.down", "↓")} tree · ${keyLabel("tui.editor.cursorLeft", "←")}/${keyLabel("tui.editor.cursorRight", "→")} collapse/expand · ${keyLabel("tui.select.confirm", "enter")} ${enterAction} · a actions · ${keyLabel("tui.select.cancel", "esc")} ${narrow && detailsMode ? "tree" : "back"}${content.length > viewport ? ` · ${keyLabel("tui.select.pageUp", "pgup")}/${keyLabel("tui.select.pageDown", "pgdn")} scroll` : ""} · auto-refresh 1s`), Number.MAX_SAFE_INTEGER, width, 1).visualLines[0] ?? "";

package/dist/src/host-phases.d.ts

@@ -45,6 +45,7 @@ export interface WorkflowPhaseSelection {
     expandedNodeIds?: readonly string[] | undefined;
     treeOnly?: boolean | undefined;
     detailsOnly?: boolean | undefined;
+    scrollTop?: number | undefined;
     actions?: {
         title: string;
         options: readonly string[];

package/dist/src/host-recovery.d.ts

@@ -1,6 +1,6 @@
 import type { Api, Model } from "@earendil-works/pi-ai";
 import { type ExtensionAPI, type ExtensionToolContext } from "@earendil-works/pi-coding-agent";
-import { FairAgentScheduler, WorkflowAgentExecutor, type AgentDefinition, type AgentExecutionRoot, type AgentProviderFailure, type AgentProviderRecovery } from "./agent-execution.js";
+import { FairAgentScheduler, WorkflowAgentExecutor, type AgentExecutionRoot, type AgentProviderFailure, type AgentProviderRecovery } from "./agent-execution.js";
 import { RunStore, type PersistedRun } from "./persistence.js";
 import { WorkflowError, type AgentIdentity, type AgentResourcePolicy, type BudgetApprovalRequest, type JsonValue, type LaunchSnapshot, type ModelSpec, type RunState, type ShellIdentity, type ShellOptions, type ShellResult, type ToolIdentity, type WorkflowMetadata, type WorkflowWorktreeReference } from "./types.js";
 import { type WorkflowRegistryApi } from "./registry.js";
@@ -24,6 +24,7 @@ export type WorkflowRecoveryContext = {
     toolContext?: ExtensionToolContext | undefined;
     signal?: AbortSignal;
     resolvedAliases?: Readonly<Record<string, string>>;
+    resolvedDynamicAliasNames?: readonly string[];
     blockedAliases?: ReadonlySet<string>;
     blockedAliasTargets?: Readonly<Record<string, string>>;
 };
@@ -49,6 +50,7 @@ export type WorkflowRecoveryDependencies = {
         modelRegistry?: WorkflowRecoveryContext["modelRegistry"];
         signal: AbortSignal;
         resolvedAliases?: Readonly<Record<string, string>>;
+        resolvedDynamicAliasNames?: readonly string[];
         blockedAliases?: ReadonlySet<string>;
         blockedAliasTargets?: Readonly<Record<string, string>>;
         withPreflight: boolean;
@@ -60,16 +62,13 @@ export type WorkflowRecoveryDependencies = {
         knownModels: ReadonlySet<string>;
         availableModels: ReadonlySet<string>;
         currentAliases: Readonly<Record<string, string>>;
+        dynamicAliasNames: readonly string[];
         blockedAliases: ReadonlySet<string>;
         blockedAliasTargets: Readonly<Record<string, string>>;
         snapshot: Readonly<LaunchSnapshot>;
         script: string | undefined;
     }>;
-    resumeRoles: (store: RunStore, snapshot: Readonly<LaunchSnapshot>, cwd: string, trustedProject: boolean) => {
-        definitions: Readonly<Record<string, AgentDefinition>>;
-        capture: (role: string, model: ModelSpec) => Promise<void>;
-    };
-    workflowAgentHandler: (store: RunStore, metadata: WorkflowMetadata, lifecycle: RunLifecycle, executor: WorkflowAgentExecutor, cwd: string, runId: string, captureRole?: (role: string, model: ModelSpec) => Promise<void>) => (prompt: string, options: Readonly<Record<string, JsonValue>>, signal: AbortSignal, identity: AgentIdentity) => Promise<JsonValue>;
+    workflowAgentHandler: (store: RunStore, metadata: WorkflowMetadata, lifecycle: RunLifecycle, executor: WorkflowAgentExecutor, cwd: string, runId: string) => (prompt: string, options: Readonly<Record<string, JsonValue>>, signal: AbortSignal, identity: AgentIdentity) => Promise<JsonValue>;
     shellForRun: (store: RunStore, metadata: WorkflowMetadata, lifecycle: RunLifecycle, command: string, options: ShellOptions, signal: AbortSignal, identity: ShellIdentity) => Promise<ShellResult>;
     toolForRun: (store: RunStore, lifecycle: RunLifecycle, context: ExtensionToolContext | undefined, identifier: string, args: Readonly<Record<string, JsonValue>>, signal: AbortSignal, identity: ToolIdentity) => Promise<JsonValue>;
     resolveWorktree: (store: RunStore, metadata: WorkflowMetadata, owner: string) => Promise<Readonly<WorkflowWorktreeReference>>;
@@ -109,6 +108,7 @@ export declare function createWorkflowRecovery(deps: WorkflowRecoveryDependencie
         toolContext?: ExtensionToolContext | undefined;
         signal?: AbortSignal | undefined;
         resolvedAliases?: Readonly<Record<string, string>>;
+        resolvedDynamicAliasNames?: readonly string[];
         blockedAliases?: ReadonlySet<string>;
         blockedAliasTargets?: Readonly<Record<string, string>>;
     }, modeOverride?: boolean, waitForCompletion?: boolean) => Promise<{

package/dist/src/host-recovery.js

@@ -28,17 +28,10 @@ function workflowRecoveryGuidance(action, state) {
         return "Interrupted workflow runs must be resumed from the interactive /workflow picker";
     return `Only failed workflow runs can be retried; source is ${state}`;
 }
-/** A snapshot can only be re-executed when it carries the current identity scheme and every role its script references. */
-function assertResumableSnapshot(snapshot, trustedProject) {
+/** A snapshot can only be re-executed when it carries the current identity scheme and validated concrete agent configurations. */
+function assertResumableSnapshot(snapshot) {
     if (snapshot.identityVersion !== LAUNCH_SNAPSHOT_IDENTITY_VERSION)
         throw new WorkflowError("RESUME_INCOMPATIBLE", "Workflow launch snapshot identity version is incompatible");
-    if (snapshot.roles === undefined)
-        throw new WorkflowError("RESUME_INCOMPATIBLE", "Workflow role definitions are missing from the launch snapshot");
-    if ((snapshot.projectRoles?.length ?? 0) > 0 && !trustedProject)
-        throw new WorkflowError("RESUME_INCOMPATIBLE", "Cannot restore project roles in an untrusted project");
-    const missingRole = snapshot.agentTypes.find((role) => !snapshot.roles?.[role]);
-    if (missingRole)
-        throw new WorkflowError("RESUME_INCOMPATIBLE", `Role definition is missing from the launch snapshot: ${missingRole}`);
 }
 function assertExpectedWorkflowState(expectedState, actualState) {
     if (expectedState !== undefined && expectedState !== actualState)
@@ -46,7 +39,7 @@ function assertExpectedWorkflowState(expectedState, actualState) {
 }
 export function persistedFailure(run, error) { const failedAt = workflowFailedAt(error); return { ...run, error: { code: error.code, message: error.message, ...(failedAt ? { failedAt } : {}) }, ...(failedAt ? { failedAt } : {}) }; }
 export function createWorkflowRecovery(deps) {
-    const { pi, home, runs, scheduler, eventPublisher, persistRunState, projectTrusted, resumeHostContext, ensureSessionLease, createAgentExecutor, activeSnapshotTools, frozenResourcePolicy, resolveLaunchPrologue, resumeRoles, workflowAgentHandler, shellForRun, toolForRun, resolveWorktree, checkpointBridge, phaseBridge, logBridge, lifecycleFor, createProviderErrorRecovery, cleanupTerminalRun, deliver, deliverTerminal, workflowToolUpdate, registry, modelSpec } = deps;
+    const { pi, home, runs, scheduler, eventPublisher, persistRunState, projectTrusted, resumeHostContext, ensureSessionLease, createAgentExecutor, activeSnapshotTools, frozenResourcePolicy, resolveLaunchPrologue, workflowAgentHandler, shellForRun, toolForRun, resolveWorktree, checkpointBridge, phaseBridge, logBridge, lifecycleFor, createProviderErrorRecovery, cleanupTerminalRun, deliver, deliverTerminal, workflowToolUpdate, registry, modelSpec } = deps;
     const coordinateRunMutation = deps.coordinateRunMutation ?? ((task) => task());
     const budgetDecisionDelivery = (metadata, request) => `Workflow ${metadata.name} budget adjustment ${request.proposalId} for run ${request.runId} requires approval. Consumed usage: ${JSON.stringify(request.consumed)}. Previous limits: ${JSON.stringify(request.previous)}. Proposed limits: ${JSON.stringify(request.proposed)}. Respond with workflow_respond using proposalId ${request.proposalId}.`;
     const appendBudgetDecisionEvent = async (run, request, type) => {
@@ -70,11 +63,11 @@ export function createWorkflowRecovery(deps) {
         const loaded = await run.store.load();
         const trustedProject = context?.projectTrusted ?? run.projectTrusted();
         const rootModel = context?.model ? { ...run.model, provider: context.model.provider, model: context.model.id } : run.model;
-        const { settingsPath, currentPolicy, previousAliases, knownModels, availableModels, currentAliases, blockedAliases, blockedAliasTargets, snapshot } = await resolveLaunchPrologue({ snapshot: loaded.snapshot, cwd: run.store.cwd, trustedProject, rootModel, ...(context?.modelRegistry ? { modelRegistry: context.modelRegistry } : {}), signal: run.abortController.signal, withPreflight: false });
+        const { settingsPath, currentPolicy, previousAliases, knownModels, availableModels, currentAliases, dynamicAliasNames, blockedAliases, blockedAliasTargets, snapshot } = await resolveLaunchPrologue({ snapshot: loaded.snapshot, cwd: run.store.cwd, trustedProject, rootModel, ...(context?.modelRegistry ? { modelRegistry: context.modelRegistry } : {}), signal: run.abortController.signal, withPreflight: false });
         await run.store.saveSnapshot(snapshot);
         scheduler.updateRunLimit(run.store.runId, snapshot.settings.concurrency);
         scheduler.setRunExtensionSettings(run.store.runId, snapshot.settings.extensionSettings);
-        run.executor = createAgentExecutor({ cwd: run.store.cwd, model: run.model, tools: activeSnapshotTools(snapshot.tools, "session"), resourceSelectors: currentPolicy.effective, extensionSettings: snapshot.settings.extensionSettings, availableModels, knownModels, modelAliases: currentAliases, blockedAliases, blockedAliasTargets, settingsPath, agentDefinitions: resumeRoles(run.store, snapshot, run.store.cwd, trustedProject).definitions, runStore: run.store, providerPause: async () => { deliver(`Workflow ${snapshot.metadata.name} paused: provider limit.`); await run.lifecycle.providerPause(); }, agentResourcePolicy: frozenResourcePolicy(currentPolicy) });
+        run.executor = createAgentExecutor({ cwd: run.store.cwd, projectTrusted: currentPolicy.projectTrusted, model: run.model, tools: activeSnapshotTools(snapshot.tools, "session"), resourceSelectors: currentPolicy.effective, extensionSettings: snapshot.settings.extensionSettings, availableModels, knownModels, modelAliases: currentAliases, dynamicModelAliasNames: dynamicAliasNames, blockedAliases, blockedAliasTargets, settingsPath, runStore: run.store, providerPause: async () => { deliver(`Workflow ${snapshot.metadata.name} paused: provider limit.`); await run.lifecycle.providerPause(); }, agentResourcePolicy: frozenResourcePolicy(currentPolicy) });
         run.executor.setRunContext(workflowRunContext(run.store.cwd, run.store.sessionId, run.store.runId, loaded.snapshot.metadata, loaded.snapshot.args, run.abortController.signal));
         const drift = aliasDrift(previousAliases, currentAliases);
         if (drift.length)
@@ -92,7 +85,7 @@ export function createWorkflowRecovery(deps) {
             await persistRunState(run.store, run.metadata, withoutActiveShells);
         await run.store.validateRetrySource();
         await run.store.validateBorrowedWorktrees();
-        assertResumableSnapshot(loaded.snapshot, trustedProject);
+        assertResumableSnapshot(loaded.snapshot);
         const rootModel = context?.model ? { ...run.model, provider: context.model.provider, model: context.model.id } : run.model;
         const controller = new AbortController();
         if (context?.signal?.aborted)
@@ -101,7 +94,7 @@ export function createWorkflowRecovery(deps) {
             context?.signal?.addEventListener("abort", () => { controller.abort(); }, { once: true });
         }
         run.abortController = controller;
-        const { settingsPath, currentPolicy, previousAliases, knownModels, availableModels, currentAliases, blockedAliases, blockedAliasTargets, snapshot, script } = await resolveLaunchPrologue({ snapshot: loaded.snapshot, cwd: run.store.cwd, trustedProject, rootModel, ...(context?.modelRegistry ? { modelRegistry: context.modelRegistry } : {}), signal: controller.signal, ...(context?.resolvedAliases ? { resolvedAliases: context.resolvedAliases } : {}), ...(context?.blockedAliases ? { blockedAliases: context.blockedAliases } : {}), ...(context?.blockedAliasTargets ? { blockedAliasTargets: context.blockedAliasTargets } : {}), withPreflight: true });
+        const { settingsPath, currentPolicy, previousAliases, knownModels, availableModels, currentAliases, dynamicAliasNames, blockedAliases, blockedAliasTargets, snapshot, script } = await resolveLaunchPrologue({ snapshot: loaded.snapshot, cwd: run.store.cwd, trustedProject, rootModel, ...(context?.modelRegistry ? { modelRegistry: context.modelRegistry } : {}), signal: controller.signal, ...(context?.resolvedAliases ? { resolvedAliases: context.resolvedAliases } : {}), ...(context?.resolvedDynamicAliasNames ? { resolvedDynamicAliasNames: context.resolvedDynamicAliasNames } : {}), ...(context?.blockedAliases ? { blockedAliases: context.blockedAliases } : {}), ...(context?.blockedAliasTargets ? { blockedAliasTargets: context.blockedAliasTargets } : {}), withPreflight: true });
         if (!script)
             throw new WorkflowError("INTERNAL_ERROR", "Resume preflight did not produce a launch script");
         const persistedSnapshot = modeOverride === undefined ? snapshot : createLaunchSnapshot({ ...snapshot, launchMode: foreground ? "foreground" : "background" });
@@ -110,8 +103,7 @@ export function createWorkflowRecovery(deps) {
             await persistRunState(run.store, run.metadata, (current) => ({ ...current, delivery: { ...(current.delivery ?? {}), mode: foreground ? "foreground" : "background", state: foreground ? "attached" : "pending" } }));
         scheduler.updateRunLimit(run.store.runId, snapshot.settings.concurrency);
         scheduler.setRunExtensionSettings(run.store.runId, snapshot.settings.extensionSettings);
-        const roles = resumeRoles(run.store, persistedSnapshot, run.store.cwd, trustedProject);
-        run.executor = createAgentExecutor({ cwd: run.store.cwd, model: rootModel, tools: activeSnapshotTools(snapshot.tools, "session"), resourceSelectors: currentPolicy.effective, extensionSettings: snapshot.settings.extensionSettings, availableModels, knownModels, modelAliases: currentAliases, blockedAliases, blockedAliasTargets, settingsPath, agentDefinitions: roles.definitions, runStore: run.store, providerPause: async () => { deliver(`Workflow ${snapshot.metadata.name} paused: provider limit.`); await run.lifecycle.providerPause(); }, agentResourcePolicy: frozenResourcePolicy(currentPolicy) });
+        run.executor = createAgentExecutor({ cwd: run.store.cwd, projectTrusted: currentPolicy.projectTrusted, model: rootModel, tools: activeSnapshotTools(snapshot.tools, "session"), resourceSelectors: currentPolicy.effective, extensionSettings: snapshot.settings.extensionSettings, availableModels, knownModels, modelAliases: currentAliases, dynamicModelAliasNames: dynamicAliasNames, blockedAliases, blockedAliasTargets, settingsPath, runStore: run.store, providerPause: async () => { deliver(`Workflow ${snapshot.metadata.name} paused: provider limit.`); await run.lifecycle.providerPause(); }, agentResourcePolicy: frozenResourcePolicy(currentPolicy) });
         const drift = aliasDrift(previousAliases, currentAliases);
         if (drift.length)
             await run.store.appendEvent({ type: "warning", message: `Model alias mappings changed on resume: ${drift.join("; ")}` });
@@ -119,7 +111,7 @@ export function createWorkflowRecovery(deps) {
         run.executor.setRunContext(runContext);
         await scheduler.cancelRun(run.store.runId);
         await run.lifecycle.resume();
-        const execution = runWorkflow(script, loaded.snapshot.args, withWorkflowFunctions({ tool: (identifier, args, signal, identity) => toolForRun(run.store, run.lifecycle, context?.toolContext, identifier, args, signal, identity), shell: (command, options, signal, identity) => shellForRun(run.store, run.metadata, run.lifecycle, command, options, signal, identity), agent: workflowAgentHandler(run.store, run.metadata, run.lifecycle, run.executor, run.store.cwd, run.store.runId, roles.capture), worktree: async (owner) => resolveWorktree(run.store, run.metadata, owner), checkpoint: checkpointBridge(run.store.runId, run.store, run.metadata, foreground, hasUI ? ui : undefined), phase: phaseBridge(run.store, run.metadata, run.lifecycle), log: logBridge(run.store, run.lifecycle, run.metadata.name) }, run.store, runContext, registry, snapshot.settings.extensionSettings), controller.signal);
+        const execution = runWorkflow(script, loaded.snapshot.args, withWorkflowFunctions({ tool: (identifier, args, signal, identity) => toolForRun(run.store, run.lifecycle, context?.toolContext, identifier, args, signal, identity), shell: (command, options, signal, identity) => shellForRun(run.store, run.metadata, run.lifecycle, command, options, signal, identity), agent: workflowAgentHandler(run.store, run.metadata, run.lifecycle, run.executor, run.store.cwd, run.store.runId), worktree: async (owner) => resolveWorktree(run.store, run.metadata, owner), checkpoint: checkpointBridge(run.store.runId, run.store, run.metadata, foreground, hasUI ? ui : undefined), phase: phaseBridge(run.store, run.metadata, run.lifecycle), log: logBridge(run.store, run.lifecycle, run.metadata.name) }, run.store, runContext, registry, snapshot.settings.extensionSettings), controller.signal);
         run.execution = execution;
         const completion = execution.result.then(async (value) => {
             await scheduler.flush(run.store.runId);
@@ -292,11 +284,11 @@ export function createWorkflowRecovery(deps) {
             const trustedProject = projectTrusted(context);
             await sourceStore.validateRetrySource();
             await sourceStore.validateBorrowedWorktrees();
-            assertResumableSnapshot(loaded.snapshot, trustedProject);
+            assertResumableSnapshot(loaded.snapshot);
             const modelRegistry = resumeHostContext(context).modelRegistry;
             const hostModel = object(host.model) && typeof host.model.provider === "string" && typeof host.model.id === "string" ? { provider: host.model.provider, id: host.model.id } : { provider: "", id: "" };
             const rootModel = { provider: hostModel.provider, model: hostModel.id, thinking: pi.getThinkingLevel() };
-            const { active, settingsPath, currentPolicy, knownModels, availableModels, currentAliases, blockedAliases, blockedAliasTargets, snapshot: childBaseSnapshot } = await resolveLaunchPrologue({ snapshot: loaded.snapshot, cwd, trustedProject, rootModel, ...(modelRegistry ? { modelRegistry } : {}), signal: signal ?? new AbortController().signal, withPreflight: true });
+            const { active, settingsPath, currentPolicy, knownModels, availableModels, currentAliases, dynamicAliasNames, blockedAliases, blockedAliasTargets, snapshot: childBaseSnapshot } = await resolveLaunchPrologue({ snapshot: loaded.snapshot, cwd, trustedProject, rootModel, ...(modelRegistry ? { modelRegistry } : {}), signal: signal ?? new AbortController().signal, withPreflight: true });
             await sourceStore.validateNamedWorktrees();
             for (const name of loaded.run.retry?.namedWorktrees ?? [])
                 await sourceStore.resolveNamedWorktree(name);
@@ -315,10 +307,10 @@ export function createWorkflowRecovery(deps) {
             const abortController = new AbortController();
             const providerErrorRecovery = createProviderErrorRecovery(context, availableModels, () => { abortController.abort(); });
             const providerPause = async () => { deliver(`Workflow ${loaded.snapshot.metadata.name} paused: provider limit.`); await lifecycle.providerPause(); };
-            const childRun = { executor: createAgentExecutor({ cwd, model, tools: activeSnapshotTools(loaded.snapshot.tools, active), resourceSelectors: currentPolicy.effective, extensionSettings: childBaseSnapshot.settings.extensionSettings, availableModels, knownModels, modelAliases: currentAliases, blockedAliases, blockedAliasTargets, settingsPath, agentDefinitions: loaded.snapshot.roles ?? {}, runStore: childStore, providerPause, agentResourcePolicy: frozenResourcePolicy(currentPolicy) }), store: childStore, metadata: loaded.snapshot.metadata, model, lifecycle, budget: childBudget, abortController, projectTrusted: () => projectTrusted(context), checkpointResolvers: new Map(), ...(providerErrorRecovery ? { providerErrorRecovery } : {}) };
+            const childRun = { executor: createAgentExecutor({ cwd, projectTrusted: currentPolicy.projectTrusted, model, tools: activeSnapshotTools(loaded.snapshot.tools, active), resourceSelectors: currentPolicy.effective, extensionSettings: childBaseSnapshot.settings.extensionSettings, availableModels, knownModels, modelAliases: currentAliases, dynamicModelAliasNames: dynamicAliasNames, blockedAliases, blockedAliasTargets, settingsPath, runStore: childStore, providerPause, agentResourcePolicy: frozenResourcePolicy(currentPolicy) }), store: childStore, metadata: loaded.snapshot.metadata, model, lifecycle, budget: childBudget, abortController, projectTrusted: () => projectTrusted(context), checkpointResolvers: new Map(), ...(providerErrorRecovery ? { providerErrorRecovery } : {}) };
             runs.set(childRunId, childRun);
             childCreated = true;
-            return { childRun, parentRunId: loaded.run.id, lineageRootRunId, concurrency: loaded.snapshot.settings.concurrency, ...(childBaseSnapshot.settings.extensionSettings === undefined ? {} : { extensionSettings: childBaseSnapshot.settings.extensionSettings }), hostModel, modelRegistry, currentAliases, blockedAliases, blockedAliasTargets };
+            return { childRun, parentRunId: loaded.run.id, lineageRootRunId, concurrency: loaded.snapshot.settings.concurrency, ...(childBaseSnapshot.settings.extensionSettings === undefined ? {} : { extensionSettings: childBaseSnapshot.settings.extensionSettings }), hostModel, modelRegistry, currentAliases, dynamicAliasNames, blockedAliases, blockedAliasTargets };
         }
         finally {
             if (!childCreated)
@@ -333,7 +325,7 @@ export function createWorkflowRecovery(deps) {
             await eventPublisher.runStarted(prepared.childRun.store, prepared.childRun.metadata);
             const { hasUI, ui } = recoveryUi(context);
             const recoveryContext = resumeHostContext(context);
-            const completed = await coldResumeRun(prepared.childRun, hasUI, ui, projectTrusted(context), { model: prepared.hostModel, modelRegistry: prepared.modelRegistry, deliveryContext: recoveryContext.deliveryContext, toolContext: recoveryContext.toolContext, resolvedAliases: prepared.currentAliases, blockedAliases: prepared.blockedAliases, blockedAliasTargets: prepared.blockedAliasTargets, ...(signal ? { signal } : {}) }, modeOverride);
+            const completed = await coldResumeRun(prepared.childRun, hasUI, ui, projectTrusted(context), { model: prepared.hostModel, modelRegistry: prepared.modelRegistry, deliveryContext: recoveryContext.deliveryContext, toolContext: recoveryContext.toolContext, resolvedAliases: prepared.currentAliases, resolvedDynamicAliasNames: prepared.dynamicAliasNames, blockedAliases: prepared.blockedAliases, blockedAliasTargets: prepared.blockedAliasTargets, ...(signal ? { signal } : {}) }, modeOverride);
             const completion = runs.get(prepared.childRun.store.runId)?.completion;
             if (completion) {
                 childStarted = true;